Merge pull request #108 from sagishahar/master

Add 'CanRestart' to output and Pester tests

1 files changed, 131 insertions, 0 deletions

diff --git a/Tests/Privesc.tests.ps1 b/Tests/Privesc.tests.ps1
index 095c946..56dfd2c 100644
--- a/Tests/Privesc.tests.ps1
+++ b/Tests/Privesc.tests.ps1
@@ -74,6 +74,137 @@ Describe 'Get-ModifiableFile' {
     }
 }
 
+Describe 'Test-ServiceDaclPermission' {
+
+    if(-not $(Test-IsAdmin)) { 
+        Throw "'Test-ServiceDaclPermission' Pester test needs local administrator privileges."
+    }
+    
+    It "Should fail finding 'sc.exe'." {
+        $ServiceName = Get-RandomName
+        $ServicePath = "C:\Program Files\service.exe"
+        
+        sc.exe create $ServiceName binPath= $ServicePath | Should Match "SUCCESS"
+        Start-Sleep -Seconds 1
+        
+        $DirectoryName = Get-RandomName
+        $env:SystemRoot = 'C:\\' + $DirectoryName
+        { Test-ServiceDaclPermission -ServiceName $ServiceName -Dacl 'DC' } | Should Throw "sc.exe not found"
+        
+        sc.exe delete $ServiceName | Should Match "SUCCESS"
+        $env:SystemRoot = 'C:\Windows'
+    }
+    
+    It "Should succeed finding 'sc.exe'." {
+        $ServiceName = Get-RandomName
+        $ServicePath = "C:\Program Files\service.exe"
+        
+        sc.exe create $ServiceName binPath= $ServicePath | Should Match "SUCCESS"
+        Start-Sleep -Seconds 1
+        
+        $DirectoryName = Get-RandomName
+        New-Item -Path $env:Temp -Name "$DirectoryName\System32" -ItemType Directory
+        New-Item -Path $env:Temp -Name "$DirectoryName\System32\sc.exe" -ItemType File
+        $env:SystemRoot = $env:Temp + "\$DirectoryName"
+        Test-ServiceDaclPermission -ServiceName $ServiceName -Dacl 'DC' | Should Be $True
+        
+        Remove-Item -Recurse -Force "$env:Temp\$DirectoryName"
+        $env:SystemRoot = 'C:\Windows'
+        sc.exe delete $ServiceName | Should Match "SUCCESS"
+    }
+    
+    It "Should fail querying WMI for a non-existent service." {
+        $ServiceName = Get-RandomName
+        { Test-ServiceDaclPermission -ServiceName $ServiceName -Dacl 'DC' } | Should Throw "not found on the machine"
+    }
+    
+    It "Should succeed querying WMI for an existenting service." {
+        $ServiceName = Get-RandomName
+        $ServicePath = "C:\Program Files\service.exe"
+        
+        sc.exe create $ServiceName binPath= $ServicePath | Should Match "SUCCESS"
+        Start-Sleep -Seconds 1
+        
+        Test-ServiceDaclPermission -ServiceName $ServiceName -Dacl 'DC' | Should Be $True
+        sc.exe delete $ServiceName | Should Match "SUCCESS"
+    }
+    
+    It "Should fail querying WMI for an existing service due to insufficient DACL permissions." {
+        $ServiceName = Get-RandomName
+        $ServicePath = "C:\Program Files\service.exe"
+        $UserSid = [System.Security.Principal.WindowsIdentity]::GetCurrent().User.value
+        
+        sc.exe create $ServiceName binPath= $ServicePath | Should Match "SUCCESS"
+        Start-Sleep -Seconds 1
+        
+        sc.exe sdset $ServiceName "D:(A;;CCDCSWRPWPDTLOCRSDRCWDWO;;;$UserSid)" | Should Match "SUCCESS"
+        { Test-ServiceDaclPermission -ServiceName $ServiceName -Dacl 'DC' } | Should Throw "not found on the machine"
+        sc.exe delete $ServiceName | Should Match "SUCCESS"
+    }
+    
+    It "Should succeed querying WMI for an existing service due to sufficient DACL permissions." {
+        $ServiceName = Get-RandomName
+        $ServicePath = "C:\Program Files\service.exe"
+        $UserSid = [System.Security.Principal.WindowsIdentity]::GetCurrent().User.value
+        
+        sc.exe create $ServiceName binPath= $ServicePath | Should Match "SUCCESS"
+        Start-Sleep -Seconds 1
+        
+        sc.exe sdset $ServiceName "D:(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;$UserSid)" | Should Match "SUCCESS"
+        Test-ServiceDaclPermission -ServiceName $ServiceName -Dacl 'DC' | Should Be $True
+        sc.exe delete $ServiceName | Should Match "SUCCESS"
+    } 
+    
+    It "Should fail running 'sc.exe sdshow' due to insufficient permissions." {
+        $ServiceName = Get-RandomName
+        $ServicePath = "C:\Program Files\service.exe"
+        $UserSid = [System.Security.Principal.WindowsIdentity]::GetCurrent().User.value
+        
+        sc.exe create $ServiceName binPath= $ServicePath | Should Match "SUCCESS"
+        Start-Sleep -Seconds 1
+        
+        sc.exe sdset $ServiceName "D:(A;;CCDCLCSWRPWPDTLOCRSDWDWO;;;$UserSid)" | Should Match "SUCCESS"
+        { Test-ServiceDaclPermission -ServiceName $ServiceName -Dacl 'DC' } | Should Throw "Could not retrieve DACL permissions"
+        sc.exe delete $ServiceName | Should Match "SUCCESS"
+    }
+    
+    It "Should succeed running 'sc.exe sdshow' due to sufficient permissions." {
+        $ServiceName = Get-RandomName
+        $ServicePath = "C:\Program Files\service.exe"
+        $UserSid = [System.Security.Principal.WindowsIdentity]::GetCurrent().User.value
+        
+        sc.exe create $ServiceName binPath= $ServicePath | Should Match "SUCCESS"
+        Start-Sleep -Seconds 1
+        
+        sc.exe sdset $ServiceName "D:(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;$UserSid)" | Should Match "SUCCESS"
+        Test-ServiceDaclPermission -ServiceName $ServiceName -Dacl 'DC' | Should Be $True
+        sc.exe delete $ServiceName | Should Match "SUCCESS"
+    }
+    
+    it "Should fail finding the service DACL value of 'WP' for the current user." {
+        $ServiceName = Get-RandomName
+        $ServicePath = "C:\Program Files\service.exe"
+        
+        sc.exe create $ServiceName binPath= $ServicePath | Should Match "SUCCESS"
+        Start-Sleep -Seconds 1
+        
+        sc.exe sdset $ServiceName "D:(A;;CCDCLCSWRPDTLOCRSDRCWDWO;;;S-1-5-4)" | Should Match "SUCCESS"
+        Test-ServiceDaclPermission -ServiceName $ServiceName -Dacl 'WP' | Should Be $False
+        sc.exe delete $ServiceName | Should Match "SUCCESS"
+    }
+    
+    it "Should succeed finding the service DACL value of 'WP' for the current user." {
+        $ServiceName = Get-RandomName
+        $ServicePath = "C:\Program Files\service.exe"
+        
+        sc.exe create $ServiceName binPath= $ServicePath | Should Match "SUCCESS"
+        Start-Sleep -Seconds 1
+        
+        sc.exe sdset $ServiceName "D:(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;S-1-5-4)" | Should Match "SUCCESS"
+        Test-ServiceDaclPermission -ServiceName $ServiceName -Dacl 'WP' | Should Be $True
+        sc.exe delete $ServiceName | Should Match "SUCCESS"
+    }
+}
 
 ########################################################
 #